What is the CVSS score of CVE-2018-9080?

CVE-2018-9080 has a CVSS 3.0 base score of 5.9 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.7%.

Storcenter Px12 450R Firmware CVE-2018-9080

MEDIUM

Improper Authentication (CWE-287)

2018-09-28 psirt@lenovo.com

Lenovo Authentication Bypass Storcenter Px12 450R Firmware Storcenter Px12 400R Firmware Storcenter Px4 300R Firmware Storcenter Px6 300D Firmware Storcenter Px4 300D Firmware Storcenter Px2 300D Firmware Storcenter Ix4 300D Firmware Storcenter Ix2 Firmware Storcenter Ix2 Dl Firmware Ez Media Backup Center Firmware Px12 450R Firmware Px12 400R Firmware Px4 400R Firmware Px4 300R Firmware Px6 300D Firmware Px4 400D Firmware Px4 300D Firmware Px2 300D Firmware Ix4 300D Firmware Ix2 Firmware

5.9

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Sep 28, 2018 - 20:29 nvd

MEDIUM 5.9

DescriptionNVD

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session.

AnalysisAI

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session. Affected products include: Lenovo Storcenter Px12-450R Firmware, Lenovo Storcenter Px12-400R Firmware, Lenovo Storcenter Px4-300R Firmware, Lenovo Storcenter Px6-300D Firmware, Lenovo Storcenter Px4-300D Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.